修复：调整游客取号限流策略

问题：移动网络共享出口 IP 会造成游客取号被误限流。

实现：移除公开取号 IP 限制，改用项目总量与手机号 HMAC 限流，并支持 Retry-After 倒计时。

server/internal/httpapi/server.go

@@ -27,16 +27,17 @@ const (
 )
 
 type Server struct {
-	db                  *gorm.DB
-	config              config.Config
-	cipher              *security.Cipher
-	logger              *slog.Logger
-	hub                 eventPublisher
-	loginLimiter        *loginLimiter
-	publicQueryLimiter  *queryLimiter
-	publicTicketLimiter *queryLimiter
-	dummyPassword       string
-	now                 func() time.Time
+	db                         *gorm.DB
+	config                     config.Config
+	cipher                     *security.Cipher
+	logger                     *slog.Logger
+	hub                        eventPublisher
+	loginLimiter               *loginLimiter
+	publicQueryLimiter         *queryLimiter
+	publicTicketProjectLimiter *queryLimiter
+	publicTicketPhoneLimiter   *queryLimiter
+	dummyPassword              string
+	now                        func() time.Time
 }
 
 func New(db *gorm.DB, cfg config.Config, logger *slog.Logger) (*Server, error) {
@@ -57,16 +58,17 @@ func NewWithEventPublisher(db *gorm.DB, cfg config.Config, logger *slog.Logger,
 	}
 	now := func() time.Time { return time.Now().UTC() }
 	return &Server{
-		db:                  db,
-		config:              cfg,
-		cipher:              fieldCipher,
-		logger:              logger,
-		hub:                 publisher,
-		loginLimiter:        newLoginLimiter(now),
-		publicQueryLimiter:  newQueryLimiter(now, 120, time.Minute),
-		publicTicketLimiter: newQueryLimiter(now, 20, time.Minute),
-		dummyPassword:       dummy,
-		now:                 now,
+		db:                         db,
+		config:                     cfg,
+		cipher:                     fieldCipher,
+		logger:                     logger,
+		hub:                        publisher,
+		loginLimiter:               newLoginLimiter(now),
+		publicQueryLimiter:         newQueryLimiter(now, 120, time.Minute),
+		publicTicketProjectLimiter: newQueryLimiter(now, cfg.PublicTicketProjectLimit, cfg.PublicTicketRateWindow),
+		publicTicketPhoneLimiter:   newQueryLimiter(now, cfg.PublicTicketPhoneLimit, cfg.PublicTicketRateWindow),
+		dummyPassword:              dummy,
+		now:                        now,
 	}, nil
 }